Server-Side Request Forgery Vulnerability in RAGFlow Product by Infiniflow
CVE-2026-49951

5.3MEDIUM

Key Information:

Vendor

Infiniflow

Status
Ragflow
Vendor
CVE Published:
6 November 2026

What is CVE-2026-49951?

RAGFlow versions before 0.27.0 are susceptible to a server-side request forgery (SSRF) vulnerability. Authenticated attackers can exploit this flaw via the POST /v1/llm/set_api_key endpoint by manipulating the base_url parameter. This can lead to the server sending requests to internal and external endpoints, revealing critical information about shared network services such as MySQL, Elasticsearch, Redis, and more. The exploitation can divulge raw exception texts, exposing internal configurations, open ports, and detail-oriented fingerprints of services, thereby increasing the risk of further attacks.

Affected Version(s)

ragflow 0 < 0.27.0

References

https://github.com/infiniflow/ragflow/releases#release-v0...
release-notes
https://github.com/infiniflow/ragflow/pull/17641
issue-trackingpatch
https://github.com/infiniflow/ragflow/commit/b058229ab3a7...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sheer Galor
.